Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-02-2024 18:30

General

  • Target

    file.html

  • Size

    311KB

  • MD5

    89d059eb59969822bc99894c0171b0ce

  • SHA1

    b67fa9946354dfbe74a1df92b2f709cf5bea8b54

  • SHA256

    a0d8506547614bcdc0f772601a5efdbf5dddc8385c0ea5aeb971537bead03d30

  • SHA512

    84ec53f15d3218aa6171f9f257828b5d94120a9570b95d57fc8e282a04182ce0a569473e2d446bd54a6ff76225f7f184ecdf1895e4fdbaf963bcd43181137f3e

  • SSDEEP

    3072:ui1gAkHnjP/Q6KSEy/RHNPaW+LN7DxRLlzglKdQwq:HgAkHnjP/QBSEqtPCN7jBdQwq

Score
10/10

Malware Config

Extracted

Family

lumma

C2

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafeab46f8,0x7ffafeab4708,0x7ffafeab4718
      2⤵
        PID:2248
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:312
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        2⤵
          PID:4092
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
          2⤵
            PID:3900
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
            2⤵
              PID:2636
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
              2⤵
                PID:1872
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2952 /prefetch:1
                2⤵
                  PID:900
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:1
                  2⤵
                    PID:1764
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                    2⤵
                      PID:2268
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2032 /prefetch:1
                      2⤵
                        PID:2584
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1712 /prefetch:8
                        2⤵
                          PID:1832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2832
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
                          2⤵
                            PID:1892
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1096
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
                            2⤵
                              PID:2032
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
                              2⤵
                                PID:5096
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
                                2⤵
                                  PID:3788
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,1516210462954249502,9956789850166550802,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
                                  2⤵
                                    PID:3216
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:5108
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3484
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:1740
                                      • C:\Users\Admin\Downloads\gamesensecracked_without_pass\gamesenseloader.exe
                                        "C:\Users\Admin\Downloads\gamesensecracked_without_pass\gamesenseloader.exe"
                                        1⤵
                                        • Suspicious use of SetThreadContext
                                        PID:3332
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          2⤵
                                            PID:740

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          360dd5debf8bf7b89c4d88d29e38446c

                                          SHA1

                                          65afff8c78aeb12c577a523cb77cd58d401b0f82

                                          SHA256

                                          3d9debe659077c04b288107244a22f1b315bcf7495bee75151a9077e71b41eef

                                          SHA512

                                          0ee5b81f0acc82befa24a4438f2ca417ae6fac43fa8c7f264b83b4c792b1bb8d4cecb94c6cbd6facc120dc10d7e4d67e014cdb6b4db83b1a1b60144bb78f7542

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          6fbbaffc5a50295d007ab405b0885ab5

                                          SHA1

                                          518e87df81db1dded184c3e4e3f129cca15baba1

                                          SHA256

                                          b9cde79357b550b171f70630fa94754ca2dcd6228b94f311aefe2a7f1ccfc7b6

                                          SHA512

                                          011c69bf56eb40e7ac5d201c1a0542878d9b32495e94d28c2f3b480772aa541bfd492a9959957d71e66f27b3e8b1a3c13b91f4a21756a9b8263281fd509c007b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c524e64-ab11-434a-b716-f2ee8a1baac0.tmp

                                          Filesize

                                          7KB

                                          MD5

                                          b5e13125382a90789643dfdae6298c6a

                                          SHA1

                                          8fcaea8a0fa30a60bd016d4aca6fb7f5074c2b91

                                          SHA256

                                          a48ad733bddbdf4181d1450bb168dfc012b0decc075426fbd370a4bc624c746f

                                          SHA512

                                          1aa15f48b2a508550fd6f1304df59fb02a3e80502cd2bf3d6041a6b3b4914d2ee0984550271041b27720d97646f34715bfea76e597ffb1a06278b405735164cb

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          fd142b5da0ac13cf6850a06addf66ef5

                                          SHA1

                                          1f2eeabc917fadd0f2511d37129097f35d228968

                                          SHA256

                                          a2c470b885fb232d8ffb730f4e262437a19c708c5172b66a918467b2d1a150df

                                          SHA512

                                          fb6f413ddf973a0ac0dc45ef3a646bd6bf8f190601216a1f350f73a4c552184c9a7c816da36b0f8ce3826e3ffc34f054dc259152b9fabf0c40207923b9986020

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          717bbb1ae6cb3d990a3d7cecf5c34d8d

                                          SHA1

                                          bc3ba22dd33c959e75d2532f94ef6ccba3b20b02

                                          SHA256

                                          067ea688defa07bf7a3d85763bca251fec3351d725ed320296778c42117d1a66

                                          SHA512

                                          c4b6dcc445363a15937daf868cdb888b0bfb7c0c32823ea3e1a41e90c2271da962b080746eb1748c999b694748550cadd5a8e3ba4550363992e3d9e6b483cfc8

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          988d8ccba479da43f9321e086d0b115f

                                          SHA1

                                          e8881c11d1abf4e8858ff2e23004671fc49c5f2a

                                          SHA256

                                          dd4ebb37861fb4e097039ee6ba9fcb24743d17ab00f912889a87c0cca248f187

                                          SHA512

                                          6a71f0074f107fd33c98740ba04386b163a37e1b79179be094727e6513633693e39456045e94a14f3e46dcd028756d63ed82390f3191f002fc8613d4e3f01a77

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          9d81f27d26b56e25604cfc21635284a2

                                          SHA1

                                          edc9ce452b4a7c8460628115e0e3bba6b98a3c2e

                                          SHA256

                                          8c82c5975d5c44ef6985cde9589bdc7f182e667428dbe7cb36261ecc254d93bf

                                          SHA512

                                          fa7b7c73d3e87fa53eaf4c4ed6ac0c36525f836df96bccdc9be7c5ca8ce2e2c1b18bcd1a2fd91cf493424e18212d827f757ebe629e74ef950994d04afa5b984b

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          9f794659d7111ad23cc06d81cd9fadd9

                                          SHA1

                                          d8dfc166a930734e4f4d37bc48af2db0d7c56331

                                          SHA256

                                          d4e563c0550c22f81a90c94a7be2ee19c61ad6f9dd6cef8b7dc023dc9e240107

                                          SHA512

                                          12a8a94910edcc7aa0845d109a6b57b9442cf33c43709238ef9d9ae664a80ebe5d61652d257ad5d2a2671acad66bfc0c70f114095a818723e23079f9bedf2d65

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          68c7866084f708ab6c6e4bca92eeb9aa

                                          SHA1

                                          778af90b19b16e8dc812a46cbf29dc2e08512170

                                          SHA256

                                          efe113d2ee933bbb0c661bc4be95b975bee36ac6fa86db5a9b4a2448fc68013c

                                          SHA512

                                          5edacc70af0e8a87e7dd0f994d6050da849757badabdab781ca29cf3f3514f25d4dd7524382cf497936ccd7831601196430ffc82a47c35b3a8e3783fc70ce933

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          a73e31b45bca7456b03ee12a166309d5

                                          SHA1

                                          7d19dc387d298076b3d466e982945fa81f9a5c6e

                                          SHA256

                                          20a5b3f85147ffd3add4d6d07a1ea82e71942bd05970caf118748ec0c84776f7

                                          SHA512

                                          ea44b2d3eea81537c399da9135ef6409d3b3abfda7bb1dcc47878c58431c677aca80f1f2d8640bd3d981738671d5d59f65a6282b9c6af696ab1fccff4140115e

                                        • C:\Users\Admin\Downloads\gamesensecracked_without_pass.zip

                                          Filesize

                                          810KB

                                          MD5

                                          31b921635f25e519736150d9b860cd33

                                          SHA1

                                          527d6786d3184f6d7e0e61efabe72b39b5fa58d4

                                          SHA256

                                          23521975c5f526909ddd77cf4c7af96ac2d0bd64928059377652e65a0f236f13

                                          SHA512

                                          08fddc1da9ffea6517f7625414c038c7c6575ccb0eb9411a3c9dc29ad7aa0117926567144baf8a1f63f6b84201d6d9e6371457bf727b2eaac232acdf065b5916

                                        • \??\pipe\LOCAL\crashpad_3940_SVYLPPHKDKAQAPZU

                                          MD5

                                          d41d8cd98f00b204e9800998ecf8427e

                                          SHA1

                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                          SHA256

                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                          SHA512

                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                        • memory/740-229-0x0000000000400000-0x0000000000445000-memory.dmp

                                          Filesize

                                          276KB

                                        • memory/740-235-0x0000000000400000-0x0000000000445000-memory.dmp

                                          Filesize

                                          276KB

                                        • memory/740-236-0x0000000000400000-0x0000000000445000-memory.dmp

                                          Filesize

                                          276KB

                                        • memory/740-237-0x0000000000400000-0x0000000000445000-memory.dmp

                                          Filesize

                                          276KB

                                        • memory/740-238-0x00000000012C0000-0x00000000012F2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/740-239-0x00000000012C0000-0x00000000012F2000-memory.dmp

                                          Filesize

                                          200KB

                                        • memory/3332-226-0x0000000000C80000-0x0000000000CD0000-memory.dmp

                                          Filesize

                                          320KB

                                        • memory/3332-225-0x0000000074890000-0x0000000075040000-memory.dmp

                                          Filesize

                                          7.7MB

                                        • memory/3332-231-0x00000000031E0000-0x00000000051E0000-memory.dmp

                                          Filesize

                                          32.0MB

                                        • memory/3332-233-0x0000000074890000-0x0000000075040000-memory.dmp

                                          Filesize

                                          7.7MB